@lanes-sh/link 0.1.0

package/src/server/index.ts

@@ -0,0 +1,331 @@
+import { challenge, type Authenticator } from '#auth';
+import type { Logger } from '#connectivity';
+import { capabilityIdForToolName } from '#server/mcp';
+import { ATTACHMENTS_PATH, stageAttachment } from './attachments.ts';
+import { allowedHostnamesFor, rebindingRefusal } from './rebinding.ts';
+import type { Generation, Generations } from './generations.ts';
+import { callerKey, failedAuthLimiter, FAILED_AUTH_PER_MINUTE, tooManyAttempts } from './edge.ts';
+import {
+  handleAuthorization,
+  isAuthorizationPath,
+  resourceMetadataUrl,
+  type AuthorizationSurface,
+} from './oauth.ts';
+
+/**
+ * The HTTP surface.
+ *
+ * Stateless streamable HTTP on a single endpoint. Statelessness is not an
+ * optimisation: the M2 target replaces instances between requests, so any
+ * in-memory session state would produce intermittent 404s. `createMcpHandler`
+ * builds a fresh server instance per request from the generation's factory,
+ * which is also what lets the tool list be a pure function of the caller's
+ * policy.
+ *
+ * Authentication happens here, in front of that factory, so the factory only
+ * ever runs for a caller whose identity is already established.
+ *
+ * What this file is *not* responsible for is which runtimes are current. A
+ * request pins one generation on the way in and uses it throughout, so a reload
+ * landing mid-request cannot change what that request is evaluated against.
+ * See `./generations.ts`.
+ */
+
+export interface ServerOptions {
+  /** The current profile runtimes, and the reload that replaces them. */
+  readonly generations: Generations;
+  /** Which profile's port, host, and token govern the endpoint itself. */
+  readonly primary: string;
+  readonly authenticator: Authenticator;
+  readonly log: Logger;
+  readonly version?: string;
+  /**
+   * How a remote client obtains a token, when the profile declares one.
+   *
+   * Absent means bearer-token-only: no metadata is published, the `401` carries
+   * no pointer, and the endpoint behaves exactly as it did before.
+   */
+  readonly authorization?: AuthorizationSurface | undefined;
+  /** Hostnames this endpoint answers to. See `./rebinding.ts`. */
+  readonly allowedHostnames?: readonly string[] | undefined;
+}
+
+export const MCP_PATH = '/mcp';
+export const RELOAD_PATH = '/reload';
+
+/**
+ * Loopback addresses. What binding to one changes is the browser threat model,
+ * not the auth model — see `allowedHostnames`.
+ */
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+
+export function isLoopback(host: string): boolean {
+  return LOOPBACK.has(host);
+}
+
+/**
+ * How often an unrecognised tool name may provoke a reload.
+ *
+ * The safety net below reloads when a call names a tool this endpoint does not
+ * advertise, which is what a just-connected provider looks like to an instance
+ * that missed the notify. An agent retrying a genuinely absent tool must not
+ * turn that into a reload per call, so it is bounded.
+ */
+const RELOAD_PROBE_MS = 10_000;
+
+export interface RequestHandler {
+  fetch(request: Request): Promise<Response>;
+  close(): Promise<void>;
+}
+
+export function createRequestHandler(options: ServerOptions): RequestHandler {
+  let probedAt = 0;
+  const failedAuth = failedAuthLimiter();
+
+  /**
+   * Re-read the config because a call named a tool we do not serve.
+   *
+   * The notify (ADR-029) reaches one instance. A second instance that was warm
+   * when the operator connected an account keeps refusing it, which would make
+   * "connecting does not need a redeploy" true only sometimes — the worst of
+   * the three possible states, because nobody can reproduce it.
+   *
+   * So the error path closes it. A tool that appeared a moment ago is
+   * indistinguishable from a tool that never existed, and both arrive here; one
+   * reload tells them apart. Nothing on the success path pays for this.
+   */
+  const probeForNewConfig = async (): Promise<boolean> => {
+    const now = Date.now();
+    if (now - probedAt < RELOAD_PROBE_MS) return false;
+    probedAt = now;
+
+    const result = await options.generations.reload();
+    return result.reloaded;
+  };
+
+  return {
+    async fetch(request) {
+      // Ahead of everything, including the pre-auth discovery routes: those are
+      // exactly what a rebound origin reaches.
+      if (options.allowedHostnames) {
+        const refusal = rebindingRefusal(request, options.allowedHostnames);
+        if (refusal) return refusal;
+      }
+
+      const url = new URL(request.url);
+
+      // Before authentication, deliberately: a client's first request is the
+      // one that discovers how to authenticate, so requiring a token to read
+      // the document that says where tokens come from would close the loop it
+      // exists to open.
+      if (options.authorization && isAuthorizationPath(url.pathname)) {
+        return await handleAuthorization(request, options.authorization);
+      }
+
+      if (url.pathname === '/health') {
+        // `status` is unauthenticated because the platform's own probe reads it
+        // and a deploy waits on it. The profile *names* are not: on a public URL
+        // that is a list of what this endpoint holds, handed to anyone who asks,
+        // and `outputs` and `mcp add` — which are the reason it was ever
+        // published — both hold the token already.
+        const named = await options.authenticator.authenticate(
+          request.headers.get('authorization'),
+        );
+
+        return Response.json({
+          status: 'ok',
+          ...(named.ok
+            ? { profile: options.primary, profiles: options.generations.current.names() }
+            : {}),
+        });
+      }
+
+      if (
+        url.pathname !== MCP_PATH &&
+        url.pathname !== ATTACHMENTS_PATH &&
+        url.pathname !== RELOAD_PATH
+      ) {
+        return new Response('Not found', { status: 404 });
+      }
+
+      const outcome = await options.authenticator.authenticate(
+        request.headers.get('authorization'),
+      );
+
+      if (!outcome.ok) {
+        options.log.warn('rejected request', { reason: outcome.reason });
+
+        // After the attempt rather than before it: keyed on the caller alone,
+        // anyone able to reach the endpoint could spend the owner's budget and
+        // lock them out, which trades a cost problem for a worse availability
+        // one. Only a failure consumes a token, so a valid credential is never
+        // refused by this.
+        const budget = failedAuth.take(callerKey(request), FAILED_AUTH_PER_MINUTE);
+        if (!budget.allowed) return tooManyAttempts(budget.retryAfterMs);
+
+        // The pointer is the whole handshake for a remote client: it reads the
+        // named document, finds the authorization server, and starts a flow.
+        // Without it the client has to guess the document's location, and a
+        // client that guesses wrong reports the endpoint as unreachable.
+        const metadata = options.authorization ? resourceMetadataUrl(request) : null;
+
+        return new Response(
+          JSON.stringify({
+            error: 'unauthorized',
+            reason: outcome.reason,
+            hint:
+              outcome.reason === 'not_configured'
+                ? 'This profile has no token yet. Run: lanes link token rotate'
+                : 'Present the profile token as: Authorization: Bearer <token>',
+          }),
+          {
+            status: 401,
+            headers: {
+              'content-type': 'application/json',
+              'www-authenticate': challenge(metadata),
+            },
+          },
+        );
+      }
+
+      // Behind the same bearer check as everything else, and deliberately not a
+      // way to *change* configuration: it re-reads what the CLI already wrote to
+      // the store this endpoint boots from, so the one-way flow ADR-004 requires
+      // — local CLI to instance — is exactly what it follows. ADR-029.
+      if (url.pathname === RELOAD_PATH) {
+        const result = await options.generations.reload();
+        return Response.json(result);
+      }
+
+      // A request works against one generation for its whole lifetime. Pinning
+      // it here rather than reading `current` at each use is what makes a reload
+      // landing mid-request invisible to this one: the config it is evaluated
+      // against cannot change between two of its own awaits.
+      let generation = options.generations.acquire();
+
+      try {
+        // Bytes in, handle out — the one thing a tool argument cannot carry,
+        // since a file in a tool call is base64 in the model's output. It stages
+        // into one named connection rather than a shared area, so a staged file
+        // stays as isolated as the account it was staged for.
+        if (url.pathname === ATTACHMENTS_PATH) {
+          return await stageAttachment({
+            profiles: generation.profiles,
+            primary: options.primary,
+            principal: outcome.principal,
+            request,
+            clientLabel: request.headers.get('x-mcp-client') ?? undefined,
+          });
+        }
+
+        // After authentication, so an unauthenticated caller cannot make the
+        // endpoint poll its store. Before `visible()`, because a skill added
+        // since the last poll must not be audited as a refusal on its first call.
+        await generation.refreshSkills();
+
+        const clientLabel = request.headers.get('x-mcp-client') ?? undefined;
+
+        // Policy-filtered discovery means an unpermitted tool is never
+        // advertised, so a call naming one is rejected by the protocol layer
+        // before dispatch — and would otherwise leave no trace. The 2026-07-28
+        // envelope requires the method and target in headers and rejects any
+        // request whose headers and body disagree, so reading them here is exact
+        // without parsing (and consuming) the body.
+        //
+        // **Only for an envelope client.** A 2025-era request carries neither
+        // header, and `createMcpHandler` is built without a `legacy` option —
+        // whose default is `'stateless'`, so those requests are served rather
+        // than refused. This check short-circuits and the refusal goes
+        // unrecorded. That is the second documented exception to
+        // `audit.every-invocation` in `docs/detailed/security.md`, asserted in
+        // `index.test.ts`. Closing it means cloning and parsing the body when
+        // the header is absent, which is what `stdio.ts` does for want of
+        // headers.
+        //
+        // `prompts/get` is included because a prompt is named exactly as a tool
+        // is — `skills_review-diff` — so the same lookup is exact.
+        // `resources/read` is **not**, and cannot be with this shape: 2026-07-28
+        // mirrors `params.uri` rather than a name into the header, and a URI does
+        // not match a wire name, so including it would record a refusal for every
+        // successful read. Recovering a capability id from a concrete URI means
+        // matching it against each registered template, which is a real design
+        // decision — not least about what to record when it matches nothing —
+        // and M4 did not take it. `resources.test.ts` asserts the gap.
+        const method = request.headers.get('mcp-method');
+        if (method === 'tools/call' || method === 'prompts/get') {
+          const toolName = request.headers.get('mcp-name');
+
+          if (toolName && !generation.visible().has(toolName)) {
+            // Before recording it as a refusal: this instance may simply be
+            // holding config older than the account the caller is naming.
+            if (await probeForNewConfig()) {
+              await options.generations.release(generation);
+              generation = options.generations.acquire();
+            }
+          }
+
+          if (toolName && !generation.visible().has(toolName)) {
+            // Recorded against the primary profile: the body has not been read,
+            // so which profile the call named is not yet known, and an attempt on
+            // a tool no profile advertises belongs to none of them in particular.
+            await generation.profiles.get(options.primary)!.dispatcher.recordRefusal({
+              principal: outcome.principal,
+              capabilityId: capabilityIdForToolName(toolName, generation.allCapabilityIds()),
+              clientLabel,
+            });
+          }
+        }
+
+        return await generation.handlerFor(outcome.principal, clientLabel).fetch(request);
+      } finally {
+        await options.generations.release(generation);
+      }
+    },
+
+    async close() {
+      await options.generations.close();
+    },
+  };
+}
+
+export interface ServeOptions extends ServerOptions {
+  readonly port?: number;
+  readonly host?: string;
+}
+
+export interface RunningServer {
+  readonly url: string;
+  stop(): Promise<void>;
+}
+
+export function serve(options: ServeOptions): RunningServer {
+  const current: Generation = options.generations.current;
+  const primary = current.profiles.get(options.primary);
+  if (!primary) throw new Error(`Profile "${options.primary}" is not among those being served.`);
+
+  // Read once, from the generation that is current at bind time. A reload
+  // cannot move a bound socket, so `instance.port` and `instance.host` are
+  // deliberately not part of what reloading re-reads (ADR-029).
+  const host = options.host ?? primary.config.instance.host;
+  const port = options.port ?? primary.config.instance.port;
+
+  const allowedHostnames = options.allowedHostnames ?? allowedHostnamesFor(host, isLoopback(host));
+  const handler = createRequestHandler({
+    ...options,
+    ...(allowedHostnames ? { allowedHostnames } : {}),
+  });
+
+  const server = Bun.serve({
+    hostname: host,
+    port,
+    fetch: (request: Request) => handler.fetch(request),
+  });
+
+  return {
+    url: `http://${host}:${port}${MCP_PATH}`,
+    async stop() {
+      await handler.close();
+      await server.stop(true);
+    },
+  };
+}

package/src/server/logging.ts

@@ -0,0 +1,41 @@
+import type { Logger } from '#connectivity';
+
+export type { Logger };
+
+/**
+ * Where an endpoint's operational events go.
+ *
+ * Distinct from the audit log, which records what a caller *did* and is a
+ * durable, hash-chained artefact. This is the other half: what happened to
+ * requests that never reached dispatch, of which a rejected credential is the
+ * one that matters. Audit cannot cover it — a refusal record needs a principal,
+ * and failing authentication is precisely not having one.
+ *
+ * Every caller used to pass an object whose four methods were empty, so the
+ * warning at the authentication edge was written and discarded on a public URL.
+ */
+
+/** Discards everything. For tests, whose output should stay readable. */
+export function silentLogger(): Logger {
+  return { debug() {}, info() {}, warn() {}, error() {} };
+}
+
+/**
+ * Timestamped lines to whichever stream is handed in.
+ *
+ * The CLI passes stderr, because stdout is what `--raw` and `--json` callers
+ * parse. The container passes stdout, which is where Cloud Run collects logs.
+ */
+export function streamLogger(write: (line: string) => void, now = () => new Date()): Logger {
+  const at = (level: string, message: string, detail?: Record<string, unknown>): void => {
+    const suffix = detail && Object.keys(detail).length > 0 ? ` ${JSON.stringify(detail)}` : '';
+    write(`${now().toISOString()} ${level} ${message}${suffix}`);
+  };
+
+  return {
+    debug: (message, detail) => at('debug', message, detail),
+    info: (message, detail) => at('info', message, detail),
+    warn: (message, detail) => at('warn', message, detail),
+    error: (message, detail) => at('error', message, detail),
+  };
+}

package/src/server/mcp/build.ts

@@ -0,0 +1,68 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import { isPrompt, isResource, isTool } from '#connectivity';
+import { SERVER_ICONS } from './icon.ts';
+import { serverInstructions } from './instructions.ts';
+import { SERVER_NAME } from './naming.ts';
+import { registerPrompt } from './prompts.ts';
+import { registerResource } from './resources.ts';
+import { registerDiscoveredTool, registerLocalTool } from './tools.ts';
+import { mergeCapabilities, type BuildServerOptions } from './visibility.ts';
+
+/**
+ * Building the MCP surface for one principal.
+ *
+ * Every registration below is downstream of `mergeCapabilities`, which has
+ * already applied policy — so this loop never decides what a caller may see, it
+ * only decides how each surviving capability is spelled in the protocol.
+ */
+export function buildMcpServer(options: BuildServerOptions): McpServer {
+  const names = [...options.profiles.keys()];
+
+  // One evaluation, two consumers. `mergeCapabilities` runs policy over every
+  // capability on every connection, and the instructions describe exactly the
+  // set that gets registered below — computing it twice would be the same
+  // answer at twice the cost, and two answers the day they drift.
+  const merged = mergeCapabilities(options);
+
+  const server = new McpServer(
+    {
+      name: SERVER_NAME,
+      version: options.version ?? '0.0.0',
+      title: `Lanes Link — ${names.join(', ')}`,
+      // First argument, and this is the half of the pairing below that is easy
+      // to get wrong in the other direction: `icons`, `description` and
+      // `websiteUrl` are `Implementation` fields that SEP-973 added, so they
+      // belong here and would be dropped from `ServerOptions`.
+      //
+      // `description` is `package.json`'s, and the test holds the two equal
+      // rather than trusting a copy to stay one. It is the whole endpoint being
+      // described, not this connection, so it does not name the profiles the
+      // way `title` does.
+      description: 'A self-hosted MCP gateway for your accounts, memory, skills, and secrets',
+      websiteUrl: 'https://github.com/lanes-sh/link',
+      icons: SERVER_ICONS,
+    },
+    // Second argument, not the first: `instructions` is a `ServerOptions` field,
+    // and `Implementation` would take it as an unknown extra and drop it from
+    // `initialize` without complaining.
+    { instructions: serverInstructions(names, merged) },
+  );
+
+  for (const [id, entry] of merged) {
+    // Discovered first: an upstream MCP server or an OpenAPI document supplies
+    // the schema, and there is no local capability object to inspect.
+    if (entry.discovered) {
+      registerDiscoveredTool(server, id, entry, options);
+      continue;
+    }
+
+    const capability = entry.capability;
+    if (!capability) continue;
+
+    if (isTool(capability)) registerLocalTool(server, id, entry, capability, options);
+    else if (isResource(capability)) registerResource(server, id, entry, capability, options);
+    else if (isPrompt(capability)) registerPrompt(server, id, entry, capability, options);
+  }
+
+  return server;
+}

package/src/server/mcp/icon.ts

@@ -0,0 +1,145 @@
+import type { Icon } from '@modelcontextprotocol/server';
+
+/**
+ * The mark the endpoint reports to a client that renders one.
+ *
+ * SEP-973 (protocol revision 2025-11-25) added `icons` to `Implementation`, so
+ * `initialize.result.serverInfo` can carry the server's own branding rather
+ * than leaving every client to generate a letter avatar from the name.
+ *
+ * **Nothing renders this in Claude today.** claude.ai shows custom connectors
+ * with a generated avatar and ignores `serverInfo.icons` entirely — as does
+ * Claude Code. That is a client gap, tracked in anthropics/claude-ai-mcp#152,
+ * where the reporter ruled out every server-side route in turn: `icons` with an
+ * https src, `icons` with a data URI, `/favicon.ico` and `/favicon.png` at the
+ * origin, and an HTML `<link rel="icon">`. None are fetched.
+ *
+ * It is here anyway because the cost is a few kilobytes on `initialize` and the
+ * alternative is a release the day the gap closes. Other clients already
+ * honour the field.
+ */
+
+/**
+ * The tile: the published mark's own geometry, used verbatim and not inset.
+ *
+ * These are the numbers from the published file — a 737.28 square at a
+ * sub-pixel offset inside a 738 × 739 box, with `rx="150"` corners. The tile is
+ * both the ground and the mask, which is what makes the stripes stop exactly
+ * where the rounded square does.
+ *
+ * **The mark is not inset, and that is a deliberate reversal.** An earlier
+ * version held it a tenth of the box clear of the edge, reasoning that a
+ * circular avatar crop would otherwise take the rounded-square silhouette. It
+ * does take it — but what the margin actually produced was a dark ring inside
+ * the circle with the stripes shrunk away from it, which reads as a small mark
+ * badly placed rather than as a mark whose corners were cropped. Filling the
+ * box is the better trade in both shapes: cropped to a circle the stripes run
+ * edge to edge, and left square the silhouette is there anyway.
+ */
+const TILE = { x: 0.360107, y: 0.859375, size: 737.28, radius: 150 } as const;
+
+/** The box the published file declares, which the tile sits inside. */
+const WIDTH = 738;
+const HEIGHT = 739;
+
+const GROUND = '#121214';
+const INK = '#ffffff';
+
+/**
+ * The icon: the published Lanes mark, filling its box, on its own dark ground.
+ *
+ * This is the mark lanes.sh serves as `/icon-light.svg` and `/icon-dark.svg`.
+ * It is *not* the glyph beside "Any MCP client" in the README diagram: that one
+ * is the Model Context Protocol's own logo, sitting in the client column next
+ * to the Anthropic and OpenAI marks, and shipping it here would have branded
+ * this endpoint with someone else's mark.
+ *
+ * Copied into `src/` rather than read from disk or fetched: the Dockerfile
+ * (`src/deployments/gcp/Dockerfile`) copies `package.json`, the lockfile,
+ * `bunfig.toml` and `src/` and nothing else, so a runtime read of a checked-in
+ * asset outside `src/` works from a checkout and returns nothing from every
+ * deployed target — the half of the bug that only shows up in production. A
+ * fetch would be worse: an icon that depends on the network resolving is an
+ * icon that is sometimes missing.
+ *
+ * **The ground is painted, not inherited.** The published pair leaves the gaps
+ * between the stripes transparent and lets the page supply the ground, which is
+ * right for a favicon on lanes.sh and wrong here: a client draws an icon on a
+ * surface this file knows nothing about, and transparent gaps mean the mark is
+ * a different thing on each one and invisible on some. Painting `#121214`
+ * behind the stripes is what makes the result the same icon everywhere, and it
+ * is why there is one entry below rather than two.
+ *
+ * The twenty-four stripes are generated rather than pasted. In the published
+ * file they are an exact arithmetic progression — same step on both axes, the
+ * export's own rounding never off by more than 0.02 units, which is under a
+ * thousandth of a pixel at 32px — so a loop says what twenty-four near-
+ * identical lines only imply.
+ */
+function mark(): string {
+  const stripes: string[] = [];
+  for (let i = 0; i < 24; i += 1) {
+    const x = (345.141 + i * 203.2425).toFixed(3);
+    const y = (-4382.52 + i * 203.2425).toFixed(3);
+    stripes.push(
+      `<rect x="${x}" y="${y}" width="143.715" height="6661.17"` +
+        ` transform="rotate(45 ${x} ${y})" fill="${INK}" />`,
+    );
+  }
+
+  // One rect shape, spelled once and used twice: as the ground the stripes are
+  // painted over, and as the mask that stops them at its edge. Written apart
+  // they are two places to change a corner radius and one place to forget.
+  const tile = `x="${TILE.x}" y="${TILE.y}" width="${TILE.size}" height="${TILE.size}" rx="${TILE.radius}"`;
+
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${WIDTH} ${HEIGHT}" role="img">`,
+    '<title>Lanes Link</title>',
+    `<rect ${tile} fill="${GROUND}" />`,
+    // The rounded square is a mask rather than a drawn shape, which is what
+    // makes the stripes stop where they do. Its id has to be stable but not
+    // unique — the icon is its own `data:` document, so nothing else is in
+    // scope to collide with it.
+    `<mask id="tile" maskUnits="userSpaceOnUse" x="0" y="0" width="${WIDTH}" height="${HEIGHT}">`,
+    `<rect ${tile} fill="#fff" />`,
+    '</mask>',
+    `<g mask="url(#tile)">${stripes.join('')}</g>`,
+    '</svg>',
+  ].join('');
+}
+
+/**
+ * Base64 rather than percent-encoding, and `Buffer` rather than `btoa`.
+ *
+ * Both forms are legal in a `data:` URI and the percent-encoded one is smaller
+ * and readable in a log, but every example in the spec and every client that
+ * has shipped support reads base64 — this is not the field to be clever in.
+ *
+ * `Buffer.from(…, 'utf8')` for the reason `src/connectivity/auth/basic/index.ts`
+ * gives: `btoa` throws above U+00FF and mangles what it does not throw on.
+ * Nothing above ASCII is in the mark today, but the failure mode of the day
+ * something is would be a corrupt icon rather than an error.
+ */
+function dataUri(svg: string): string {
+  return `data:image/svg+xml;base64,${Buffer.from(svg, 'utf8').toString('base64')}`;
+}
+
+/**
+ * One entry, and deliberately no `theme`.
+ *
+ * `theme` says which UI a client should pick this icon *for*, so it is a claim
+ * that there is another one to pick instead. The icon carries its own ground
+ * and looks the same on either, and two identical entries labelled `light` and
+ * `dark` would be metadata describing a variation that does not exist. If a
+ * theme-specific mark is ever wanted, that is the point at which the field
+ * earns its place.
+ *
+ * `sizes: ['any']` is what the spec spells for a scalable icon. SVG is a SHOULD
+ * for clients and PNG a MUST, so a client could honour `icons` and still skip
+ * this one — a rasterised entry is the fix for that, and it can wait until a
+ * client we care about needs it, because a PNG blob checked in here is one
+ * nobody can regenerate from a clean checkout.
+ */
+export const SERVER_ICONS: Icon[] = [
+  { src: dataUri(mark()), mimeType: 'image/svg+xml', sizes: ['any'] },
+];

package/src/server/mcp/index.ts

@@ -0,0 +1,32 @@
+/**
+ * The MCP surface.
+ *
+ * Six files, each answering one question:
+ *
+ *   visibility  what this principal may see — policy, applied once
+ *   naming      how a capability id is spelled on the wire
+ *   schema      how a vendor's JSON Schema is made safe to publish
+ *   routing     how the profile and connection reach a resource or a prompt
+ *   instructions  what the endpoint says it is for, before any tool is called
+ *   tools / resources / prompts   how each capability kind is registered
+ *   build       the loop that puts them together
+ *
+ * It was one 685-line file, and the seam that mattered was invisible in it:
+ * everything in `visibility` decides *what* is exposed and everything else
+ * decides *how*. A discovery leak can only come from the first, which is now
+ * one file with one entry point.
+ */
+
+export { buildMcpServer } from './build.ts';
+export { serverInstructions } from './instructions.ts';
+export { SERVER_NAME, capabilityIdForToolName, toolNameFor } from './naming.ts';
+export { scopeResourceUri } from './routing.ts';
+export { sanitizeSchema } from './schema.ts';
+export {
+  mergeCapabilities,
+  oneProfile,
+  visibleCapabilities,
+  type BuildServerOptions,
+  type MergedCapability,
+  type ProfileRuntime,
+} from './visibility.ts';